Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69798
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain bof.de designates 80.242.145.70 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZRD_DKvrXy1gdesxbnNK+n8vVKT1K=P4ocU=m9aZMX2A@mail.gmail.com>
References: <CAGa2bXbNFb0tV+Xqavz9m62RDxobey3BmyN0L7g9ATFxMS_KBA@mail.gmail.com>
	<CAH-PCH7TbexgCAVphaC_H8AF-V5UfNysy863Gq1sOzkxgQ01XA@mail.gmail.com>
	<CAJ26g5QH4j3K2peF7rGO-2uO_mjBK4kQELXCBQVXJOe9A7UEsw@mail.gmail.com>
	<CAGa2bXZRD_DKvrXy1gdesxbnNK+n8vVKT1K=P4ocU=m9aZMX2A@mail.gmail.com>
Date: Wed, 23 Oct 2013 09:35:19 +0200
Message-ID: <CAJ26g5TzN4T9m54bmygKZWOMThFzzJb8XwtoL4a7kO9X=EAkpw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: internals <internals@lists.php.net>, Ferenc Kovacs <tyra3l@gmail.com>
Content-Type: multipart/alternative; boundary=bcaec548a7872c89b004e9638fc9
Subject: Re: [PHP-DEV] session_regenerate_id(true) by default
From: bof@bof.de (Patrick Schaaf)

--bcaec548a7872c89b004e9638fc9
Content-Type: text/plain; charset=ISO-8859-1

Hi Yasuo,

Am 23.10.2013 02:56 schrieb "Yasuo Ohgaki" <yohgaki@ohgaki.net>:
>
> On Tue, Oct 22, 2013 at 8:10 PM, Patrick Schaaf <bof@bof.de> wrote:
>>
>> Working on the issue for our own application, I'm in the process of
teaching our session wrapping class to regenerate ID often - but when doing
so, first setting up the previous session ID with two pieces of
information: a short timeout of 20 seconds or something like that, and a
"forwarding ID" which references the new session ID.
>>
>> I want to do this because I want to regenerate IDs often (also based on
a rather short timeout), and I'm concerned about parallel in-flight
requests - a high probability reality with ajax getting more and more
traction - still presenting the old session ID a second or two after a
request determined to regenerate.
>
> Session save handlers lock session data to avoid mess, but your approach
works without lock
> in many cases. However, it may result in inconsistent session data (i.e.
over written data),
> so I would  not recommend it as general usage.

While true for us, that is a separate issue. The parallel in-flight
requests meeting an invalidated session, will happen as well with fully
locked sessions - for example they will wait on the lock for the old
session ID while the regenerating script is still before the regeneration
point. When the lock is lifted (with regenerate(true)) they will then see
an empty session, potentially affecting their operation due to missing
context.

Regarding non-full session locking, going that way is a conscious decision
for us. We find that most of the time the session data we use is readonly,
i.e. a once set up set of contextual information is used but not modified
by e.g. additional ajax requests. Full locking in these cases, coupled with
the occasional longer running script, results in full serialization of
request processing, which translates into much increased total latency for
the end user.

Thus, our general approach is to shortly open the session, capturing
$_SESSION to class static storage, and closing the session again. Setter
methods of our helper class then maintain a dirty flag, and at the end of
the script run (or explicitly called), a "flush" method examines that dirty
flag, and only when dirty, it opens the session again and replaces all
session variables with the full set of variables modified by that script
(so no modifications of several parallel scripts are mixed together -
simple last-one-wins, which makes reasoning about correctness somewhat
easier).

> The main idea of this proposal is "Making PHP secure by default".
> It does not worth to keep insecure default forever because of the initial
implementation
> had bug. IMHO.

I'm fully agreed on changing the default!

> BTW, I prefer not to raise errors for "false", since it has valid usage

Exactly.

best regards
  Patrick

--bcaec548a7872c89b004e9638fc9--